Discover more from Euphoric Recall
The Twitter Files Parts XI and XII Unrolled
How Twitter let the intelligence community in.
Euphoric Recall is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.
You can find all the Twitter Files unrolled here.
2.In August 2017, when Facebook decided to suspend 300 accounts with “suspected Russian origin,” Twitter wasn’t worried. Its leaders were sure they didn’t have a Russia problem.
3.“We did not see a big correlation.” “No larger patterns.” “FB may take action on hundreds of accounts, and we may take action on ~25.”
4.“KEEP THE FOCUS ON FB”: Twitter was so sure they had no Russia problem, execs agreed the best PR strategy was to say nothing on record, and quietly hurl reporters at Facebook:
5.“Twitter is not the focus of inquiry into Russian election meddling right now - the spotlight is on FB,” wrote Public Policy VP Colin Crowell:
6.In September, 2017, after a cursory review, Twitter informed the Senate it suspended 22 possible Russian accounts, and 179 others with “possible links” to those accounts, amid a larger set of roughly 2700 suspects manually examined.
7.Receiving these meager results, a furious Senator Mark Warner of Virginia – ranking Democrat on the Intelligence Committee – held an immediate press conference to denounce Twitter’s report as “frankly inadequate on every level.”
8.“,” mused Crowell the day after Warner’s presser, after receiving an e-circular from Warner’s re-election campaign, asking for “$5 or whatever you can spare.” “LOL,” replied General Counsel Sean Edgett.
9.“KEEP PRODUCING MATERIAL” After meeting with congressional leaders, Crowell wrote: “Warner has political incentive to keep this issue at top of the news, maintain pressure on us and rest of industry to keep producing material for them.”
10.“TAKING THEIR CUES FROM HILLARY CLINTON” Crowell added Dems were taking cues from Hillary Clinton, who that week said: “It’s time for Twitter to stop dragging its heels and live up to the fact that its platform is being used as a tool for cyber-warfare.”
11. In growing anxiety over its PR problems, Twitter formed a “Russia Task Force” to proactively self-investigate.
12.The “Russia Task Force” started mainly with data shared from counterparts at Facebook, centered around accounts supposedly tied to Russia’s Internet Research Agency (IRA). But the search for Russian perfidy was a dud:
13. OCT 13 2017: “No evidence of a coordinated approach, all of the accounts found seem to be lone-wolf type activity (different timing, spend, targeting, <$10k in ad spend).”
14.OCT 18 2017: “First round of RU investigation… 15 high risk accounts, 3 of which have connections with Russia, although 2 are RT.”
15.OCT 20 2017: “Built new version of the model that is lower precision but higher recall which allows to catch more items. We aren’t seeing substantially more suspicious accounts. We expect to find ~20 with a small amount of spend.”
16.OCT 23 2017: “Finished with investigation… 2500 full manual account reviews, we think this is exhaustive… 32 suspicious accounts and only 17 of those are connected with Russia, only 2 of those have significant spend one of which is Russia Today...remaining <$10k in spend.”
17.Twitter’s search finding “only 2” significant accounts, “one of which is Russia Today,” was based on the same data that later inspired panic headlines like “Russian Influence Reached 126 Million Through Facebook Alone”:
19.In the weeks after Warner’s presser, a torrent of stories sourced to the Intel Committee poured into the news, an example being Politico’s October 13, “Twitter deleted data potentially crucial to Russia probes.”
20.“Were Twitter a contractor for the FSB… they could not have built a more effective disinformation platform,” Johns Hopkins Professor (and Intel Committee “expert”) Thomas Rid told Politico.
21.As congress threatened costly legislation, and Twitter began was subject to more bad press fueled by the committees, the company changed its tune about the smallness of its Russia problem.
22.“Hi guys.. Just passing along for awareness the writeup here from the WashPost today on potential legislation (or new FEC regulations) that may affect our political advertising,” wrote Crowell.
23. In Washington weeks after the first briefing, Twitter leaders were told by Senate staff that “Sen Warner feels like tech industry was in denial for months.” Added an Intel staffer: “Big interest in Politico article about deleted accounts."
25.“Knowing that our ads policy and product changes are an effort to anticipate congressional oversight, I wanted to share some relevant highlights of the legislation Senators Warner, Klobuchar and McCain will be introducing,” wrote Policy Director Carlos Monje soon after.
26.“THE COMMITTEES APPEAR TO HAVE LEAKED” Even as Twitter prepared to change its ads policy and remove RT and Sputnik to placate Washington, congress turned the heat up more, apparently leaking the larger, base list of 2700 accounts.
27.Reporters from all over started to call Twitter about Russia links. Buzzfeed, working with the University of Sheffield, claimed to find a “new network” on Twitter that had “close connections to… Russian-linked bot accounts.”
28.“IT WILL ONLY EMBOLDEN THEM.” Twitter internally did not want to endorse the Buzzfeed/Sheffield findings:
29. “SENATE INTEL COMMITTEE IS ASKING… POSSIBLE TO WHIP SOMETHING TOGETHER?” Still, when the Buzzfeed piece came out, the Senate asked for “a write up of what happened.” Twitter was soon apologizing for the same accounts they’d initially told the Senate were not a problem.
30.“REPORTERS NOW KNOW THIS IS A MODEL THAT WORKS” This cycle – threatened legislation, wedded to scare headlines pushed by congressional/intel sources, followed by Twitter caving to moderation asks – would later be formalized in partnerships with federal law enforcement.
31.Twitter soon settled on its future posture. In public, it removed content “at our sole discretion.” Privately, they would “off-board” anything “identified by the U.S.. intelligence community as a state-sponsored entity conducting cyber-operations.”
32.Twitter let the “USIC” into its moderation process. It would not leave. Wrote Crowell, in an email to the company’s leaders: “We will not be reverting to the status quo.”
2.By 2020, Twitter was struggling with the problem of public and private agencies bypassing them and going straight to the media with lists of suspect accounts.
3.In February, 2020, as COVID broke out, the Global Engagement Center – a fledgling analytic/intelligence arms of the State Department – went to the media with a report called, “Russian Disinformation Apparatus Taking Advantage of Coronavirus Concerns.”
4.The GEC flagged accounts as “Russian personas and proxies” based on criteria like, “Describing the Coronavirus as an engineered bioweapon,” blaming “research conducted at the Wuhan institute,” and “attributing the appearance of the virus to the CIA.”
5.State also flagged accounts that retweeted news that Twitter banned the popular U.S. ZeroHedge, claiming the episode “led to another flurry of disinformation narratives.” ZH had done reports speculating that the virus had lab origin.
6.The GEC still led directly to news stories like the AFP’s headline, “Russia-linked disinformation campaign led to coronavirus alarm, US says,” and a Politico story about how “Russian, Chinese, Iranian Disinformation Narratives Echo One Another.”
7.“YOU HAVEN’T MADE A RUSSIA ATTRIBUTION IN SOME TIME” When Clemson’s Media Forensics Hub complained Twitter hadn’t “made a Russia attribution” in some time, Trust and Safety chief Yoel Roth said it was “revelatory of their motives.”
8.“WE’RE HAPPY TO WORK DIRECTLY WITH YOU ON THIS, INSTEAD OF NBC.” Roth tried in vain to convince outsider researchers like the Clemson lab to check with them before pushing stories about foreign interference to media.
9.Twitter was also trying to reduce the number of agencies with access to Roth. “If these folks are like House Homeland Committee and DHS, once we give them a direct contact with Yoel, they will want to come back to him again and again,” said policy director Carlos Monje.
10.When the State Department/GEC – remember this was 2020, during the Trump administration – wanted to publicize a list of 5,500 accounts it claimed would “amplify Chinese propaganda and disinformation” about COVID, Twitter analysts were beside themselves.
11.The GEC report appeared based on DHS data circulated earlier that week, and included accounts that followed “two or more” Chinese diplomatic accounts. They reportedly ended up with a list “nearly 250,000” names long, and included Canadian officials and a CNN account:
12.Roth saw GEC’s move as an attempt by the GEC to use intel from other agencies to “insert themselves” into the content moderation club that included Twitter, Facebook, the FBI, DHS, and others:
13.The GEC was soon agreeing to loop in Twitter before going public, but they were using a technique that had boxed in Twitter before. “The delta between when they share material and when they go to the press continues to be problematic,” wrote one comms official.
15.“IT MAKES SENSE TO PUSH BACK ON GEC PARTICIPATION IN THIS FORUM” When the FBI informed Twitter the GEC wanted to be included in the regular “industry call” between companies like Twitter and Facebook and the DHS and FBI, Twitter leaders balked at first.
16.Facebook, Google, and Twitter executives were united in opposition to GEC’s inclusion, with ostensible reasons including, “The GEC’s mandate for offensive IO to promote American interests.”
17.A deeper reason was a perception that unlike the DHS and FBI, which were “apolitical,” as Roth put it, the GEC was “political,” which in Twitter-ese appeared to be partisan code. “I think they thought the FBI was less Trumpy,” is how one former DOD official put it.
18.After spending years rolling over for Democratic Party requests for “action” on “Russia-linked” accounts, Twitter was suddenly playing tough. Why? Because, as Roth put it, it would pose “major risks” to bring the GEC in, “especially as the election heats up.”
19.When senior lawyer Stacia Cardille tried to argue against the GEC’s inclusion to the FBI, the words resonated “with Elvis, not Laura,” i.e. with agent Elvis Chan, not Foreign Influence Task Force (FITF) unit chief Laura Dehmlow:
20.Eventually the FBI argued, first to Facebook, for a compromise solution: other USG agencies could participate in the “industry” calls, but the FBI and DHS would act as sole “conduits.”
21.Roth reached out to Chan with concerns about letting the “press-happy” GEC in, expressing hope they could keep the “circle of trust small.”
22."STATE... NSA, and CIA" Chan reassured him it would be a “one-way” channel, and “State/GEC, NSA, and CIA have expressed interest in being allowed on in listen mode only.”
23."BELLY BUTTON" “We can give you everything we’re seeing from the FBI and USIC agencies,” Chan explained, but the DHS agency CISA “will know what’s going on in each state.” He went on to ask if industry could “rely on the FBI to be the belly button of the USG."
24.They eventually settled on an industry call via Signal. In an impressive display of operational security, Chan circulated private numbers of each company’s chief moderation officer in a Word Doc marked “Signal Phone Numbers,” subject-lined, “List of Numbers.”
25.Twitter was taking requests from every conceivable government body, beginning with the Senate Intel Committee (SSCI), which seemed to need reassurance Twitter was taking FBI direction. Execs rushed to tell “Team SSCI” they zapped five accounts on an FBI tip:
26.Requests arrived and were escalated from all over: from Treasury, the NSA, virtually every state, the HHS, from the FBI and DHS, and more:
27.They also received an astonishing variety of requests from officials asking for individuals they didn’t like to be banned. Here, the office for Democrat and House Intel Committee chief Adam Schiff asks Twitter to ban journalist Paul Sperry:
28.“WE DON’T DO THIS” Even Twitter declined to honor Schiff’s request at the time. Sperry was later suspended, however.
29.Twitter honored almost everyone else’s requests, even those from GEC – including a decision to ban accounts like and because GEC identified them as “GRU-controlled” and linked “to the Russian government,” respectively:
30.The GEC requests were what a former CIA staffer working at Twitter was referring to, when he said, “Our window on that is closing,” meaning they days when Twitter could say no to serious requests were over.
31.Remember the 2017 “internal guidance” in which Twitter decided to remove any user “identified by the U.S. intelligence community” as a state-sponsored entity committing cyber operations? By 2020 such identifications came in bulk.
32.“USIC" requests often simply began “We assess” and then provided lists (sometimes, in separate excel docs) they believed were connected to Russia’s Internet Research Agency and committing cyber ops, from Africa to South America to the U.S.:
33.One brief report, sent right after Russia’s invasion of Ukraine early last year, flagged major Russian outlets like Vedomosti and Gazeta.ru. Note the language about “state actors” fits Twitter’s internal guidance.
34.Some reports were just a paragraph long and said things like: “The attached email accounts… were possibly used for “influence operations, social media collection, or social engineering.” Without further explanation, Twitter would be forwarded an excel doc:
35.They were even warned about publicity surrounding a book by former Ukraine prosecutor Viktor Shokhin, who alleged “corruption by the U.S. government” – specifically by Joe Biden.
36.By the weeks before the election in 2020, Twitter was so confused by the various streams of incoming requests, staffers had to ask the FBI which was which:
37.“I APOLOGIZE IN ADVANCE FOR YOUR WORK LOAD”: Requests poured in from FBI offices all over the country, day after day, hour after hour: If Twitter didn’t act quickly, questions came: “Was action taken?” “Any movement?”
39.It all led to the situation described by two weeks ago, in which Twitter was paid $3,415,323, essentially for being an overwhelmed subcontractor. Twitter wasn’t just paid. For the amount of work they did for government, they were underpaid.